×
How AusISA collects, uses, stores, and protects your personal information, and the rights you have over it under the Privacy Act and the Australian Privacy Principles.
Australian Information Security Academy Pty Ltd (AusISA, we, us) is committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This policy explains how we collect, hold, use, and disclose personal information in connection with our training courses and website.
We collect personal information that you provide directly when registering for a course or signing up for notifications:
Identity: first name, last name;
Contact: email address, phone number;
Professional: organisation, role/title, IRAP assessor status and assessor number (if applicable);
Eligibility: Australian citizenship status, existing security clearance status, certification evidence and CV documents provided for eligibility verification;
Accessibility: dietary requirements and accessibility needs (for in-person courses);
Other: any additional notes you provide in registration or notification forms.
We do not collect financial information directly. Payment processing is handled by our third-party payment provider, Airwallex Pty Ltd, which operates under its own privacy policy.
Where a course or event is vetted, we collect the evidence described in the Participant Vetting Policy for the purpose of the vetting decision.
We use the information we collect for the following purposes:
processing and managing your course registration and enrolment;
issuing invoices and confirming payment;
providing access to course materials via our learning management system;
arranging catering and accessibility accommodations for in-person courses;
verifying IRAP assessor status with the Australian Signals Directorate where applicable;
sending course-related communications (confirmations, reminders, pre-reading materials);
notifying you of new course dates if you have opted in;
responding to your enquiries.
Your personal information is stored in Australia using Amazon Web Services (AWS) infrastructure in the Asia Pacific (Sydney) region (ap-southeast-2). This includes registration and enrolment records in encrypted databases, course progress and assessment data in our learning management system, and email notification preferences.
All data is encrypted at rest and in transit.
We do not transfer personal information outside of Australia except as required for payment processing through Airwallex (which may process transactions through its global infrastructure) and for email delivery through AWS Simple Email Service.
Access to your personal information is restricted to: AusISA administrative staff, for course administration, enrolment management, and support; course facilitators, limited to information necessary for delivering training (name, organisation, assessor status); and Airwallex Pty Ltd, for payment processing only, governed by their privacy policy.
We do not sell, rent, or share your personal information with third parties for marketing purposes.
We may disclose information where required or authorised by Australian law.
Course registrations and enrolment records: retained for 7 years from the date of course completion (P-013), consistent with Australian tax record-keeping requirements.
Learning management system accounts: retained for the duration of your enrolment plus 2 years (P-014) to support ongoing professional development records.
Notification subscriptions: retained until you unsubscribe, at which point your record is deleted.
Payment records: retained by Airwallex in accordance with their retention policy.
Retention and disposal are managed under the Record Management Policy.
Under the Australian Privacy Principles, you have the right to:
access the personal information we hold about you;
request correction of any inaccurate, incomplete, or out-of-date information;
unsubscribe from marketing communications at any time using the link in any notification email;
request deletion of your personal information (subject to our legal record-keeping obligations);
complain if you believe we have breached the APPs.
Access requests are handled under the Record Management Policy, which explains the response timeframe and the limited circumstances in which released records may be sanitised.
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. Our security measures include:
encryption of data at rest and in transit (TLS 1.2+);
access controls and multi-factor authentication for administrative systems;
regular database backups with tamper-proof retention policies;
infrastructure hosted in Australian data centres (AWS Sydney).
Our website does not use tracking cookies or third-party analytics services.
We may use essential cookies for session management on our learning management system.
We may update this policy from time to time. Material changes will be noted on this page with an updated revision date.
If you have questions about this privacy policy, wish to access or correct your information, or wish to make a complaint, contact us by email at privacy@ausinfosec.academy, or by post at Australian Information Security Academy Pty Ltd, Level 4, 1 Moore Street, Canberra ACT 2601.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au/privacy/privacy-complaints.